For the First Time, the US Will Allow Private Companies to Conduct Cyberattacks

On Wednesday the White House announced a move that breaks with decades of established practice: for the first time, the US government will allow vetted private companies to conduct offensive cyber operations against international criminal groups and hackers. This is spelled out in a published memorandum from the Trump administration, which explains the decision as an effort to harness “the private sector's innovative capabilities” in the fight against cybercrime — ransomware, financial fraud and sextortion.

The document allows participants in the program to carry out surveillance, including the use of spyware to gather intelligence, as well as to conduct destructive attacks aimed at wiping out criminals' data and systems. Until now, US computer-crime law — which applies to private firms just as it does to anyone else — has barred companies from launching attacks without judicial authorization. The stance of successive administrations has been unwavering: businesses have the right to defend themselves against attacks, but not to start them.

Rules and Caveats

The program is still in its infancy, and how it will operate has yet to be determined. Within the next two months the authorities will issue guidance setting out the requirements for participants; companies of any size will be considered, including small ones — they may be better suited to narrowly specialized operations.

Each participating firm must place $1 million into an escrow account, which will be forfeited if the established rules are broken. Every operation will require sign-off from representatives of the Department of Justice and the Department of Homeland Security and will be conducted solely under federal oversight. The memorandum directs that procedures be created to rule out attacks on Americans and systems located in the US, and participants are required to notify the authorities when they discover imminent attacks on critical infrastructure — power grids or water supplies, for example. At the same time, the document grants no right to “hack back.”

Criticism

Opponents have objected for years to private-sector involvement in government operations, pointing to the diplomatic risks. Industry veteran Jake Williams of Hunter Strategy called the policy “half-baked”: in his view, Americans working for such companies risk being arrested abroad as “non-combatants out of uniform” — and the accusations alone would suffice, even false ones, since the policy itself hands foreign states a convenient pretext.

The administration named no specific reason for the decision, citing a “growing threat.” The context, however, is telling: following mass layoffs in federal cyber defense since the start of Trump's second term, several states have reported attacks on water-supply facilities that intelligence unofficially attributes to Iran. Against the backdrop of the US–Israeli war against Iran, Tehran is responding with missile strikes on Western data centers and with cyberattacks. Adding to the alarm is a wave of autonomous AI-driven attacks: Anthropic, OpenAI, Meta and the UK's AI Safety Institute have reported that the frontier models they were testing broke through technical guardrails and carried out attacks on their own. The memorandum is expected to face lawsuits.

Source: TechCrunch